In the Claims : 

Please cancel Claims 1,3,4 and 27, without prejudice; and amend Claims 2, 
7, 13, 14 and 20 as indicated below. The status of all pending claims is as follows: 



1. (Currently Amended) An unauthorized access prevention system, 

including: 

a search unit searching the flowing-in path of unauthorized access to 
services disclosed from a user's communication network; 

a determination unit determining a place to implement a countermeasure for 
protecting the services from the unauthorized access based on the result of the search; and 

a notification unit notifying, according to a determination that the 
countermeasure is implemented in the flow source that makes the unauthorized access 
flow into the user's communication network, the determination to athe flow source. 

2. (Currently Amended) A recording medium in which a program that 
directs a computer to implement a countermeasure against unauthorized access is 
recorded and in which the program can be read by the computer, and the program directs 
the computer to perform the following processes by being executed by the computer: 

a detection process of detecting the unauthorized access to the services 
disclosed from a user's communication network; and 

when the detection of the unauthorized access is notified, performs the 
following processes: 
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a search process of searching the flowing-in path of the unauthorized access 
to the services disclosed from the user's communication network; 

a determination process of determining the place to implement the 
countermeasure for protecting the services from the unauthorized access based on the 
result of the search; and 

a notification process of notifying, according to a determination that the 
countermeasure is implemented in the flow source that makes the unauthorized access 
flow into the user's communication network, the determination to the flow source. 

3-4. (Cancelled) 

5 . (Original) The recording medium according to claim 2, wherein 
the process of searching the flowing-in path is performed by the computer 

based on the monitoring information on the traffic transmitted by a user's communication 
network and the unauthorized access information indicating the contents of the 
unauthorized access. 

6. (Original) The recording medium according to claim 5, wherein 
the monitoring information includes at least the position information on an 

edge router arranged on the border between the user's communication network and the 
communication network adjacent to the user's communication network and the 
monitoring information on the traffic that flows into the user's communication network 
via the edge router. 
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7. (Currently Amended) The recording medium according to 
claim 2, wherein 

the notification process makes the computer execute a process of notifying; 
the determination to the flow source after mutual attestation is conducted between th e 
notification unit and with the flow source of the unauthorized access is p e rform e d by th e 
comput e r . 

8 . (Original) The recording medium according to claim 2 , wherein 
the process of notifying the determination to the flow source after 

information on a security policy for the operation of each network is exchanged with the 
flow source that transmits the unauthorized access is performed by the computer. 

9. (Original) The recording medium according to claim 8, wherein 
information on a security policy is the information indicating the time 

required till the countermeasure against the unauthorized access is cancelled after the 
unauthorized access is not detected any more. 

1 0. (Original) The recording medium according to claim 9, wherein 
when the time indicated by the information on the security policy differs 

between the user' communication network and the flow source, a shorter time of the two 
is used as the time required till the countermeasure against unauthorized access is 
cancelled after the unauthorized access is not detected any more. 
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1 1 . (Original) The recording medium according to claim 1 0, wherein 
the process of notifying the flow source of the determination and the 

information indicating the time required till the countermeasure against the unauthorized 
access is cancelled after the unauthorized access is not detected any more is performed by 
the computer. 

1 2 . (Original) The recording medium according to claim 2, wherein 
the process of notifying the flow source of the unauthorized access of the 

determination using the communication path that differs from the flowing-in path of the 
unauthorized access is performed by the computer. 

1 3 . (Currently Amended) The recording medium according to 
claim 2, w herein A recording medium in which a program that directs a computer to 
implement a countermeasure against unauthorized access is recorded and in which the 
program can be read by the computer, and the program directs the computer to perform 
the following processes by being executed by the computer: 

a detection process of detecting the unauthorized access to the services 
disclosed from a user's communication network; and 

when the detection of the unauthorized access is notified, performs the 
following processes: 

a search process of searching the flowing-in path of the unauthorized access 
to the services disclosed from the user's communication network; 
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a determination process of determining the place to implement the 
countermeasure for protecting the services from the unauthorized access based on the 
result of the search; and 

the notification process dir e cts the comput e r to perform th e proc e ss of a 
notification process for j udging whether, when it is determined that the countermeasure is 
implemented in the flow source that makes the unauthorized access flow into the user's 
communication network, the determination is notified to the flow source s wherein 

by having the program executed by the computer; 

the unauthorized access countermeasure implementation control process 
that has the countermeasure for protecting the services from the unauthorized access 
implemented in the flow source when it is judged that the determination will not be 
notified to the flow source based on the above notification process is further performed by 
the computer. 

14. (Currently Amended) The recording medium according to 
claim 13, wherein 

the judgement is made based on the-judgement information on the flow 
source that is given in advance. 

1 5 . (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 

the unauthorized access countermeasure implementation control process 
that has the countermeasure for protecting the services from the unauthorized access 
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implemented in the user's communication network based on the determination that said 
countermeasure is implemented in the user's communication network is performed by the 
computer. 

16. (Original) The recording medium according to claim 1 5, wherein 
the process of implementing the countermeasure in the POP (point of 

presence) edge router to which the flow source of the unauthorized access is connected is 
performed by the computer. 

1 7 . (Original) The recording medium according to claim 1 6, wherein 
the process of identifying the POP edge router to which the transmitter that 

transmits the unauthorized access is connected based on the information obtained from 
the operation management system that manages the operation of the user's 
communication network is further performed by the computer. 

1 8 . (Original) The recording medium according to claim 1 5 , wherein 
by having the program executed by the computer; 

the process of obtaining a notification of the determination that 
unauthorized access to the services disclosed from a communication network different 
from the user's communication network is made to flow into said other communication 
network is further performed by the computer; and 

the process of implementing the countermeasure for protecting the services 
disclosed from said other communication network from the unauthorized access related to 
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the notification in the user's communication network when the notification is obtained by 
the notification obtaining process is performed by the computer. 

1 9 . (Original) The recording medium according to claim 1 5 , wherein 
the countermeasure implemented by the unauthorized access 

countermeasure implementation control process is cancelled after the unauthorized access 
is not detected any more and a preset time passes. 

20. (Currently Amended) The recording medium according to 
claim 19, wherein 

Thethe preset time is set based on the security policy on the network 
operation of both the user's communication network and the other communication 
network. 

2 1 . (Original) The recording medium according to claim 20, wherein 
when the times set between the user's communication network and the other 

communication network based on the security policy on the network operation of both 
networks differ between both networks, the countermeasure is cancelled after the 
unauthorized access is not detected any more and a shorter time of the two passes. 

22. (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 
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the process of obtaining a notification of the determination that 
unauthorized access to the services disclosed from a communication network different 
from the user's communication network is made to flow into said other communication 
network is performed by the computer; 

the process of searching the flowing-in path of the unauthorized access 
related to the notification in the user's communication network when the notification is 
obtained by the notification obtaining process is performed by the computer; 

the process of determining the place to implement the countermeasure for 
protecting the services disclosed from said other communication network from the 
unauthorized access related to the notification based on the result of the search when the 
notification is obtained by the notification obtaining process is performed by the 
computer; and 

the process of notifying, according to a determination that the 
countermeasure is implemented in the flow source that makes the unauthorized access 
related to the notification flow into the user's communication network when the 
notification is obtained by the notification obtaining process, the determination to the flow 
source is performed by the computer. 

23 . (Original) The recording medium according to claim 22, wherein 
by having the program executed by the computer; 

the unauthorized access countermeasure implementation control process 
that has the countermeasure for protecting the services disclosed from the user's 
communication network or the other communication network from the unauthorized 
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access related to the notification implemented in the communication network of the 
notification source of the notification when the notification obtained by said notification 
obtaining process is the same as that obtained in the past is further performed by the 
computer. 

24. (Original) The recording medium according to claim 23, wherein 
the process of notifying the information that uniquely identifies the 

unauthorized access related to the notification when the determination is notified is 

performed by the computer. 

2 5 . (Original) The recording medium according to claim 2 , wherein 
by having the program executed by the computer; 

the process of recording the history of the notification is further performed 
by the computer. 

2 6 . (Original) An unauthorized access prevention method, including: 

searching the flowing-in path of unauthorized access to the services 
disclosed from the user's communication network; 

determining the place to implement the countermeasure for protecting the 
services from the unauthorized access based on the result of the search; and 

notifying, according to a determination that the countermeasure is 
implemented in the flow source that makes the unauthorized access flow into the user's 
communication network, the determination to the flow source. 
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27. (Cancelled) 
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